C.W.K.
Stream
Lesson 04 of 05 · published

uv.lock, Universal Resolution, Tool Isolation

~11 min · uv, concepts, lockfile

Level 0Newbie
0 XP0/55 lessons0/16 achievements
0/80 XP to next level80 XP to go0% complete

Three uv concepts make it more than 'fast pip' — they're the reason it can replace half a dozen tools.

uv.lock — a real lockfile. uv.lock pins every direct and transitive dep with content hashes. Reproducibility is bit-exact across machines. uv sync installs precisely what's locked; if anything diverges, sync fails loudly. This is what requirements.txt always pretended to be and never was.

Universal resolution. uv.lock contains entries for multiple Python versions and platforms (macOS arm64, macOS x64, Linux, Windows). One lockfile, every target. That's how a team running macOS dev machines + a Linux CI server + a Windows Docker host all get reproducible installs from the same lockfile.

Tool isolation. uv tool install ruff installs ruff in its own private venv at ~/.local/share/uv/tools/ruff/, then exposes ruff on PATH. The tool can't conflict with your project's deps; your project can't break the tool. This is what pipx did, but built in.

Built-in Python management. uv python install 3.13 downloads a portable Python (from the python-build-standalone project) and registers it. Multiple versions coexist. uv python pin 3.13 writes .python-version to lock this project to that interpreter. No pyenv, no system-Python confusion.

Code

Anatomy of uv.lock·toml
# uv.lock (excerpt — auto-generated, NEVER hand-edit)
version = 1
requires-python = ">=3.11"
resolution-markers = ["sys_platform == 'darwin' and python_version >= '3.11'", ...]

[[package]]
name = "flask"
version = "3.0.3"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://...", hash = "sha256:abc..." }
wheels = [
  { url = "https://...", hash = "sha256:def..." },
]
dependencies = [
  { name = "blinker", marker = "..." },
  { name = "click", marker = "..." },
  { name = "itsdangerous", marker = "..." },
  { name = "jinja2", marker = "..." },
  { name = "werkzeug", marker = "..." },
]
Inspect managed Pythons·bash
# What Pythons does uv know about?
uv python list
# cpython-3.13.0-macos-aarch64-none    /Users/you/.local/share/uv/python/...
# cpython-3.12.4-macos-aarch64-none    /Users/you/.local/share/uv/python/...
# cpython-3.11.9-macos-aarch64-none    /Users/you/.local/share/uv/python/...
# (...and many available-but-not-installed entries)

# Install + use
uv python install 3.13
uv python pin 3.13            # writes .python-version

# This project now uses 3.13, regardless of system Python.

External links

Exercise

In a uv project, run 'uv lock' (or 'uv sync') and open uv.lock. Read one package entry — note the multiple wheel URLs (one per platform), the SHA256 hashes, and the dep tree. Compare it mentally to a hand-written requirements.txt. The difference is reproducibility.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.